AWS Security Specialty (SCS-C03) flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

GuardDuty finding severity scale

GuardDuty scores findings from 0.1 to 8.9, where 7.0–8.9 is High, 4.0–6.9 is Medium, and 0.1–3.9 is Low, which drives automated response thresholds.

Isolate compromised EC2 instance

Replace the instance's security groups with a forensic group that allows no inbound or outbound traffic, preserving the running instance and its memory for investigation instead of terminating it.

GuardDuty delegated administrator

A member account designated through Organizations to administer GuardDuty for all accounts, aggregating findings and centrally managing suppression rules and trusted IP lists.

Amazon Detective behavior graph

Detective continuously ingests CloudTrail, VPC Flow Logs, EKS audit logs, and GuardDuty findings into a behavior graph retained for up to one year to support entity-level investigation.

Security Hub ASFF format

The AWS Security Finding Format is the normalized JSON schema Security Hub uses to ingest, correlate, and display findings from GuardDuty, Inspector, Macie, and partner products.

GuardDuty malware protection

When enabled, GuardDuty scans an isolated copy of EBS volumes attached to suspicious EC2 instances, so production volumes and running workloads are never modified by the scan.

CloudTrail data events

S3 object-level operations and Lambda Invoke calls are not logged by default; they must be enabled per trail and incur additional per-event charges.

VPC Flow Logs NODATA

A NODATA record means no traffic was observed during an aggregation interval; these records are skipped by default when flow logs publish to CloudWatch Logs.

CloudTrail log integrity validation

Digest files containing SHA-256 hashes and RSA signatures let you prove that delivered log files were not altered after CloudTrail wrote them to S3.

CloudWatch Logs metric filter

A metric filter scans ingested log events for a matching pattern and increments a custom metric that a CloudWatch alarm can use to notify or trigger remediation.

CloudTrail Lake query retention

CloudTrail Lake is a managed event data store queried with SQL, with configurable retention up to seven years, avoiding a separate S3 and Athena pipeline for investigations.

Security group statefulness

Return traffic for an allowed connection is automatically permitted by a security group; NACLs are stateless and require explicit rules for both request and response directions.

IMDSv2 session token

Instance Metadata Service v2 requires a PUT request to obtain a session token before reading credentials, mitigating SSRF theft; enforce it with HttpTokens set to required.

Gateway vs interface endpoint

Gateway endpoints serve only S3 and DynamoDB through route table targets with no hourly fee; interface endpoints create PrivateLink ENIs and charge hourly plus per gigabyte.

Shield Advanced benefits

Adds 24/7 access to the DDoS Response Team, cost protection for scaling during an attack, advanced real-time metrics, and included WAF usage for a fixed subscription.

Session Manager no bastion

Session Manager provides shell access through the SSM agent and IAM authorization, requiring no inbound ports, no bastion hosts, and no public IP addresses on instances.

IAM policy evaluation order

An explicit deny overrides every allow; otherwise an explicit allow must exist somewhere; anything not explicitly allowed is implicitly denied by default.

SCP does not grant

Service control policies filter the maximum permissions available inside member accounts but never grant permissions themselves, and the management account is exempt from them.

Permissions boundary behavior

A permissions boundary sets the maximum permissions identity-based policies can grant to a user or role, but it does not by itself grant any permissions.

Role chaining duration limit

When a role assumes another role, the resulting session is capped at one hour regardless of the MaximumSessionDuration configured on the target role.

IAM Access Analyzer external access

Access Analyzer analyzes resource-based policies and CloudTrail activity to identify resources shared outside the account or organization and to flag unused permissions.

Attribute-based access control

Authorization driven by tags, using condition keys such as aws:ResourceTag and aws:PrincipalTag to match many resources with one policy instead of enumerating ARNs.

KMS envelope encryption

KMS issues a data key; you encrypt the data locally with the plaintext key, discard it, and store the KMS-encrypted copy of the key alongside the ciphertext.

S3 Block Public Access levels

Four settings covering ACLs, bucket policies, ignored ACLs, and account-wide application; they can be set per bucket or across an entire account to prevent public exposure.

Secrets Manager rotation

Native scheduled rotation invokes a Lambda function to update the secret and its target database, using staging labels AWSCURRENT and AWSPENDING to switch versions safely.

S3 Object Lock modes

Object Lock requires versioning; compliance mode retention cannot be overridden by any principal, while governance mode can be bypassed with s3:BypassGovernanceRetention.

Macie sensitive data discovery

A machine-learning service that samples and classifies S3 objects to find PII, credentials, and custom data identifiers, publishing findings to EventBridge for automated response.

Control Tower guardrails

Preventive guardrails are implemented as SCPs and detective guardrails as AWS Config rules, applied across the landing zone and accounts created by Account Factory.

Config conformance pack

A YAML template bundling multiple AWS Config rules and optional remediation actions that can be deployed to many accounts in an organization in a single operation.

Audit Manager evidence collection

Automatically gathers configuration data and CloudTrail activity as evidence against a selected framework such as SOC 2 or PCI DSS, then produces assessment reports.

Organization tag policies

Define permitted tag keys and values across accounts to standardize resource tagging; they do not enforce tagging or block creation of noncompliant resources.

RAM resource sharing

AWS Resource Access Manager shares supported resources such as subnets, Transit Gateways, and License Manager configurations with other accounts or organizational units without duplication.